[release-v3.29] Auto pick #9451: exlude Calico's special devices from dataIfaceRegex

api/pkg/apis/projectcalico/v3/felixconfig.go

@@ -555,7 +555,8 @@ type FelixConfigurationSpec struct {
 	// BPFDataIfacePattern is a regular expression that controls which interfaces Felix should attach BPF programs to
 	// in order to catch traffic to/from the network.  This needs to match the interfaces that Calico workload traffic
 	// flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the
-	// cluster.  It should not match the workload interfaces (usually named cali...).
+	// cluster.  It should not match the workload interfaces (usually named cali...) or any other special device managed
+	// by Calico itself (e.g., tunnels).
 	BPFDataIfacePattern string `json:"bpfDataIfacePattern,omitempty" validate:"omitempty,regexp"`
 
 	// BPFL3IfacePattern is a regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices)

felix/config/config_params.go

@@ -180,7 +180,7 @@ type Config struct {
 	BPFLogLevel                        string            `config:"oneof(off,info,debug);off;non-zero"`
 	BPFLogFilters                      map[string]string `config:"keyvaluelist;;"`
 	BPFCTLBLogFilter                   string            `config:"oneof(all);;"`
-	BPFDataIfacePattern                *regexp.Regexp    `config:"regexp;^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*|tunl0$|vxlan.calico$|vxlan-v6.calico$|wireguard.cali$|wg-v6.cali$)"`
+	BPFDataIfacePattern                *regexp.Regexp    `config:"regexp;^((en|wl|ww|sl|ib)[Popsx].*|(eth|wlan|wwan|bond).*)"`
 	BPFL3IfacePattern                  *regexp.Regexp    `config:"regexp;"`
 	BPFConnectTimeLoadBalancingEnabled bool              `config:"bool;;"`
 	BPFConnectTimeLoadBalancing        string            `config:"oneof(TCP,Enabled,Disabled);TCP;non-zero"`

felix/dataplane/linux/bpf_ep_mgr.go

@@ -491,7 +491,6 @@ func newBPFEndpointManager(
 		logFilters:              config.BPFLogFilters,
 		hostname:                config.Hostname,
 		fibLookupEnabled:        fibLookupEnabled,
-		dataIfaceRegex:          config.BPFDataIfacePattern,
 		l3IfaceRegex:            config.BPFL3IfacePattern,
 		workloadIfaceRegex:      workloadIfaceRegex,
 		epToHostAction:          config.RulesConfig.EndpointToHostAction,
@@ -534,6 +533,31 @@ func newBPFEndpointManager(
 		features:         dataplanefeatures,
 	}
 
+	specialInterfaces := []string{"egress.calico"}
+	if config.RulesConfig.IPIPEnabled {
+		specialInterfaces = append(specialInterfaces, dataplanedefs.IPIPIfaceName)
+	}
+	if config.RulesConfig.VXLANEnabled {
+		specialInterfaces = append(specialInterfaces, dataplanedefs.VXLANIfaceNameV4)
+	}
+	if config.RulesConfig.VXLANEnabledV6 {
+		specialInterfaces = append(specialInterfaces, dataplanedefs.VXLANIfaceNameV6)
+	}
+	if config.RulesConfig.WireguardEnabled {
+		specialInterfaces = append(specialInterfaces, config.RulesConfig.WireguardInterfaceName)
+	}
+	if config.RulesConfig.WireguardEnabledV6 {
+		specialInterfaces = append(specialInterfaces, config.RulesConfig.WireguardInterfaceNameV6)
+	}
+
+	for i, d := range specialInterfaces {
+		specialInterfaces[i] = "^" + regexp.QuoteMeta(d) + "$"
+	}
+	exp := "(" + config.BPFDataIfacePattern.String() + "|" + strings.Join(specialInterfaces, "|") + ")"
+
+	log.WithField("dataIfaceRegex", exp).Debug("final dataIfaceRegex")
+	m.dataIfaceRegex = regexp.MustCompile(exp)
+
 	if healthAggregator != nil {
 		healthAggregator.RegisterReporter(bpfEPManagerHealthName, &health.HealthReport{
 			Ready: true,

felix/dataplane/linux/dataplanedefs/dataplane_defs.go

@@ -17,6 +17,7 @@ package dataplanedefs
 import "github.com/vishvananda/netlink"
 
 const (
+	IPIPIfaceName                           = "tunl0"
 	VXLANIfaceNameV4                        = "vxlan.calico"
 	VXLANIfaceNameV6                        = "vxlan-v6.calico"
 	VXLANDefaultProto netlink.RouteProtocol = 80